linux.git/drivers/net/wireless/marvell, branch v4.9

mwifiex: printk() overflow with 32-byte SSIDs

2016-11-17T11:16:52+00:00

SSIDs aren't guaranteed to be 0-terminated. Let's cap the max length
when we print them out.

This can be easily noticed by connecting to a network with a 32-octet
SSID:

[ 3903.502925] mwifiex_pcie 0000:01:00.0: info: trying to associate to
'0123456789abcdef0123456789abcdef ' bssid
xx:xx:xx:xx:xx:xx

Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Signed-off-by: Brian Norris 
Cc: 
Acked-by: Amitkumar Karwar 
Signed-off-by: Kalle Valo

cfg80211: add ability to check DA/SA in A-MSDU decapsulation

2016-10-12T07:19:10+00:00

We should not accept arbitrary DA/SA inside A-MSDUs, it could be used
to circumvent protections, like allowing a station to send frames and
make them seem to come from somewhere else.

Add the necessary infrastructure in cfg80211 to allow such checks, in
further patches we'll start using them.

Signed-off-by: Johannes Berg

cfg80211: let ieee80211_amsdu_to_8023s() take only header-less SKB

2016-10-12T07:19:10+00:00

There's only a single case where has_80211_header is passed as true,
which is in mac80211. Given that there's only simple code that needs
to be done before calling it, export that function from cfg80211
instead and let mac80211 call it itself.

Signed-off-by: Johannes Berg

mwifiex: code rearrangement in mwifiex_usb_host_to_card()

2016-09-26T17:39:43+00:00

This patch helps get rid of goto statement and improves readability.

Signed-off-by: Amitkumar Karwar 
Signed-off-by: Cathy Luo 
Signed-off-by: Kalle Valo

mwifiex: fix race condition causing tx timeout

2016-09-26T17:39:42+00:00

It's been observed that in a corner case mwifiex_usb_tx_complete()
gets called before we exit from mwifiex_usb_host_to_card() after
submitting the urb. 'data_sent' flag remains set in this case. It
blocks further Tx packets and triggers watchdog timeout.

The problem is fixed by setting data_sent and port_block flag at
correct place.

Signed-off-by: Cathy Luo 
Signed-off-by: Shengzhen Li 
Signed-off-by: Amitkumar Karwar 
Signed-off-by: Kalle Valo

mwifiex: fix kernel crash for USB chipsets

2016-09-26T17:39:41+00:00

Following crash issue is observed during TCP traffic stress
test

[ 2253.625439] NMI watchdog: BUG: soft lockup - CPU#3 stuck for 22s!
[kworker/u17:1:5191]
[ 2253.625520] Call Trace:
[ 2253.625527]  [] ? moal_spin_lock+0x30/0x30
[usb8xxx]
[ 2253.625533]  [] ? wlan_wmm_lists_empty+0xb/0xf0
[mlan]
[ 2253.625537]  [] mlan_main_process+0x1b3/0x720
[mlan]
[ 2253.625540]  [] woal_main_work_queue+0x45/0x80
[usb8xxx]
[ 2253.625543]  [] process_one_work+0x150/0x3f0
[ 2253.625545]  [] worker_thread+0x121/0x520
[ 2253.625547]  [] ? rescuer_thread+0x330/0x330
[ 2253.625549]  [] kthread+0xd2/0xf0
[ 2253.625551]  [] ?
kthread_create_on_node+0x1c0/0x1c0
[ 2253.625553]  [] ret_from_fork+0x7c/0xb0
[ 2253.625555]  [] ?
kthread_create_on_node+0x1c0/0x1c0

In mwifiex_usb_tx_complete(), we are updating port->block_status first
and then freeing the skb attached to that URB. We may end up attaching
new skb to URB in a corner case and same will be freed. This results in
the kernel crash. The problem is solved by changing the sequence.

Signed-off-by: Cathy Luo 
Signed-off-by: Shengzhen Li 
Signed-off-by: Amitkumar Karwar 
Signed-off-by: Kalle Valo

mwifiex: cfg80211 set_default_mgmt_key handler

2016-09-26T15:19:42+00:00

Previously device used to start using IGTK key as Tx key as soon as it
gets downloaded in add_key(). This patch implements set_default_mgmt_key
handler. We will update Tx key ID in set_default_mgmt_key().

Signed-off-by: Ganapathi Bhat 
Signed-off-by: Amitkumar Karwar 
Signed-off-by: Kalle Valo

mwifiex: fix null pointer deference when adapter is null

2016-09-17T15:26:32+00:00

If adapter is null the error exit path in mwifiex_shutdown_sw is
to down the semaphore sem and print some debug via mwifiex_dbg.
However, passing a NULL adapter to mwifiex_dbg causes a null
pointer deference when accessing adapter->dev.  This fix checks
for a null adapter at the start of the function and to exit
without the need to up the semaphore and we also skip the debug
to avoid the null pointer dereference.

Signed-off-by: Colin Ian King 
Signed-off-by: Kalle Valo

mwifiex: fix error handling in mwifiex_create_custom_regdomain

2016-09-17T15:25:57+00:00

smatch reports:

sta_cmdresp.c:1053 mwifiex_create_custom_regdomain() warn: possible memory leak of 'regd'

Indeed, mwifiex_create_custom_regdomain() returns NULL in the
case that channel is missing in the TLV without freeing regd.

Moreover, some other error paths in this function return ERR_PTR
values which are assigned without checking to the regd field in
the mwifiex_adapter struct.  The latter is only null-checked where
used.

Fix by freeing regd in the error path, and only update
priv->adapter->regd if the returned pointer is valid.

Cc: Amitkumar Karwar 
Cc: Nishant Sarmukadam 
Signed-off-by: Bob Copeland 
Signed-off-by: Kalle Valo

mwifiex: firmware name correction for usb8997 chipset

2016-09-14T17:02:14+00:00

Similar to pcie8997 chipset, first firmware submitted for usb8997
chipset will be usbusb8997_combo_v4.bin. This patch corrects the
name used in driver.

Signed-off-by: Ganapathi Bhat 
Signed-off-by: Amitkumar Karwar 
Signed-off-by: Kalle Valo